daemonset.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ template "falco.fullname" . }}
  labels:
    app: {{ template "falco.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
      app: {{ template "falco.fullname" .}}
      role: security
  template:
    metadata:
      name: {{ template "falco.fullname" .}}
      labels:
        app: {{ template "falco.fullname" .}}
        role: security
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/rules: {{ include (print $.Template.BasePath "/configmap-rules.yaml") . | sha256sum }}
        {{- if .Values.daemonset.podAnnotations }}
{{ toYaml .Values.daemonset.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ template "falco.serviceAccountName" .}}
      {{- if (and .Values.ebpf.enabled .Values.ebpf.settings.hostNetwork) }}
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      {{- end }}
{{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
{{- end }}
{{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
{{- end }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          image: {{ template "falco.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
          securityContext:
            privileged: true
          args:
            - /usr/bin/falco
            {{- if .Values.containerd.enabled }}
            - --cri
            - /run/containerd/containerd.sock
            {{- end }}
            - -K
            - /var/run/secrets/kubernetes.io/serviceaccount/token
            - -k
            - "https://$(KUBERNETES_SERVICE_HOST)"
            - -pk
        {{- if .Values.extraArgs }}
{{ toYaml .Values.extraArgs | indent 12 }}
        {{- end }}
          env:
          {{- if .Values.ebpf.enabled }}
            - name: FALCO_BPF_PROBE
              value:
          {{- end }}
          {{- if .Values.proxy.httpProxy }}
            - name: http_proxy
              value: {{ .Values.proxy.httpProxy }}
          {{- end }}
          {{- if .Values.proxy.httpsProxy }}
            - name: https_proxy
              value: {{ .Values.proxy.httpsProxy }}
          {{- end }}
          {{- if .Values.proxy.noProxy }}
            - name: no_proxy
              value: {{ .Values.proxy.noProxy }}
          {{- end }}
          {{- if .Values.timezone }}
            - name: TZ
              value: {{ .Values.timezone }}
          {{- end }}
          {{- range $key, $value := .Values.daemonset.env }}
            - name: "{{ $key }}"
              value: "{{ $value }}"
          {{- end }}
          volumeMounts:
            {{- if .Values.docker.enabled }}
            - mountPath: /host/var/run/docker.sock
              name: docker-socket
            {{- end}}
            {{- if .Values.containerd.enabled }}
            - mountPath: /host/run/containerd/containerd.sock
              name: containerd-socket
            {{- end}}
            - mountPath: /host/dev
              name: dev-fs
              readOnly: true
            - mountPath: /host/proc
              name: proc-fs
              readOnly: true
            - mountPath: /host/boot
              name: boot-fs
              readOnly: true
            - mountPath: /host/lib/modules
              name: lib-modules
            - mountPath: /host/usr
              name: usr-fs
              readOnly: true
            - mountPath: /dev/shm
              name: dshm
            - mountPath: /host/etc
              name: etc-fs
              readOnly: true
            - mountPath: /etc/falco
              name: config-volume
            {{- if .Values.customRules }}
            - mountPath: /etc/falco/rules.d
              name: rules-volume
            {{- end }}
            {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
            - mountPath: /var/run/falco/
              name: shared-pipe
              readOnly: false
            {{- end }}
            {{- if .Values.falco.grpc.enabled }}
            {{- if .Values.falco.grpc.unixSocketPath }}
            - mountPath: {{ include "falco.unixSocketDir" . }}
              name: grpc-socket-dir
            {{- else }}
            - mountPath: /etc/falco/certs
              name: certs-volume
              readOnly: true
            {{- end }}
            {{- end }}
      {{- if .Values.integrations.natsOutput.enabled }}
        - name: {{ .Chart.Name }}-nats
          image: sysdig/falco-nats:latest
          imagePullPolicy: Always
          args: [ "/bin/falco-nats", "-s", {{ .Values.integrations.natsOutput.natsUrl | quote }}]
          volumeMounts:
            - mountPath: /var/run/falco/
              name: shared-pipe
      {{- end }}
      {{- if .Values.integrations.snsOutput.enabled }}
        - name: {{ .Chart.Name }}-sns
          image: sysdig/falco-sns:latest
          imagePullPolicy: Always
          args: [ "/bin/falco-sns", "-t", {{ .Values.integrations.snsOutput.topic | quote }}]
          volumeMounts:
            - mountPath: /var/run/falco/
              name: shared-pipe
          env:
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "falco.fullname" . }}
                  key: aws_access_key_id
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "falco.fullname" . }}
                  key: aws_secret_access_key
            - name: AWS_DEFAULT_REGION
              valueFrom:
                configMapKeyRef:
                  name: {{ template "falco.fullname" . }}
                  key: aws_default_region
      {{- end }}
      {{- if .Values.integrations.pubsubOutput.enabled }}
        - name: {{ .Chart.Name }}-pubsub
          image: sysdiglabs/falco-pubsub:latest
          imagePullPolicy: Always
          args: [ "/bin/falco-pubsub", "-t", {{ .Values.integrations.pubsubOutput.topic | quote }}]
          volumeMounts:
            - mountPath: /var/run/falco/
              name: shared-pipe
          env:
            - name: GOOGLE_PROJECT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "falco.fullname" . }}
                  key: gcp-project-id
            - name: GOOGLE_CREDENTIALS_DATA
              valueFrom:
                secretKeyRef:
                  name: {{ template "falco.fullname" . }}
                  key: gcp-credentials-data
      {{- end }}
      {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
      initContainers:
          - name: init-pipe
            image: busybox
            command: ['mkfifo','/var/run/falco/nats']
            volumeMounts:
            - mountPath: /var/run/falco/
              name: shared-pipe
              readOnly: false
      {{- end }}
      volumes:
        - name: dshm
          emptyDir:
            medium: Memory
        {{- if .Values.docker.enabled }}
        - name: docker-socket
          hostPath:
            path: {{ .Values.docker.socket }}
        {{- end}}
        {{- if .Values.containerd.enabled }}
        - name: containerd-socket
          hostPath:
            path: {{ .Values.containerd.socket }}
        {{- end}}
        - name: dev-fs
          hostPath:
            path: /dev
        - name: proc-fs
          hostPath:
            path: /proc
        - name: boot-fs
          hostPath:
            path: /boot
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: usr-fs
          hostPath:
            path: /usr
        - name: etc-fs
          hostPath:
            path: /etc
        - name: config-volume
          configMap:
            name: {{ template "falco.fullname" . }}
            items:
              - key: falco.yaml
                path: falco.yaml
              - key: falco_rules.yaml
                path: falco_rules.yaml
              - key: falco_rules.local.yaml
                path: falco_rules.local.yaml
              - key: application_rules.yaml
                path: rules.available/application_rules.yaml
              {{- if .Values.auditLog.enabled }}
              - key: k8s_audit_rules.yaml
                path: k8s_audit_rules.yaml
              {{- end }}
        {{- if .Values.customRules }}
        - name: rules-volume
          configMap:
            name: {{ template "falco.fullname" . }}-rules
        {{- end }}
        {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
        - name: shared-pipe
          emptyDir: {}
        {{- end }}
        {{- if .Values.falco.grpc.enabled }}
        {{- if .Values.falco.grpc.unixSocketPath }}
        - name: grpc-socket-dir
          hostPath: 
            path: {{ include "falco.unixSocketDir" . }}
        {{- else }}
        - name: certs-volume
          secret:
            secretName: {{ template "falco.fullname" . }}-certs
            items:
              - key: server.key
                path: server.key
              - key: server.crt
                path: server.crt
              - key: ca.crt
                path: ca.crt
        {{- end }}
        {{- end }}
  updateStrategy:
{{ toYaml .Values.daemonset.updateStrategy | indent 4 }}